Ingress network elements can assign Security Group Tags (SGTs) to inbound network traffic/packets. An SGT is a tag/mark on a network packet that may be used to enforce an access policy in the network. The SGT can be assigned on the basis of a source device or source user credentials.